Securely Access Your Server From Anywhere¶

mkdir duckdns
cd duckdns
vi duck.sh

echo url="https://www.duckdns.org/update?domains=gofoss&token=ebaa3bd3-177c-4230-8d91-a7a946b5a51e&ip=" | curl -k -o ~/duckdns/duck.log -K -

chmod 700 duck.sh

sudo apt install cron
crontab -e

*/5 * * * * ~/duckdns/duck.sh >/dev/null 2>&1

./duck.sh

cat duck.log

sudo apt install git
git clone https://github.com/dehydrated-io/dehydrated.git

cd dehydrated
vi domains.txt

*.gofoss.duckdns.org > gofoss.duckdns.org

vi config

CHALLENGETYPE="dns-01"
BASEDIR=/etc/dehydrated
HOOK="${BASEDIR}/hook.sh"
CONTACT_EMAIL=gofoss@gofoss.net

vi hook.sh

DOMAIN="gofoss.duckdns.org"                         # provide your domain here
TOKEN="ebaa3bd3-177c-4230-8d91-a7a946b5a51e"        # provide your token here

case "$1" in
    "deploy_challenge")
        curl "https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&txt=$4"
        echo
        ;;
    "clean_challenge")
        curl "https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&txt=removed&clear=true"
        echo
        ;;
    "deploy_cert")
        ;;
    "unchanged_cert")
        ;;
    "startup_hook")
        ;;
    "exit_hook")
        ;;
    *)
        echo Unknown hook "${1}"
        exit 0
        ;;
esac

mkdir certs
chmod a+x dehydrated
chmod a+x hook.sh
cd ..
sudo mv dehydrated /etc/dehydrated
sudo chown -R gofossadmin:gofossadmin /etc/dehydrated

sudo ls -al /etc/dehydrated

drwxr-xr-x 2 gofossadmin gofossadmin   4096 Jan 01 00:00 .
drwxr-xr-x 4 gofossadmin gofossadmin   4096 Jan 01 00:00 ..
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 certs
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 config
-rwxr-xr-x 1 gofossadmin gofossadmin 700000 Jan 01 00:00 dehydrated
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 docs
-rw-r--r-- 1 gofossadmin gofossadmin     20 Jan 01 00:00 domains.txt
-rwxr-xr-x 1 gofossadmin gofossadmin    700 Jan 01 00:00 hook.sh

bash /etc/dehydrated/dehydrated --register --accept-terms

# INFO: Using main config file /etc/dehydrated/config
+ Generating account key...
+ Registering account key with ACME server...
+ Done!

bash /etc/dehydrated/dehydrated -c

+ Creating chain cache directory /etc/dehydrated/chains
Processing gofoss.duckdns.org
+ Creating new directory /etc/dehydrated/certs/gofoss.duckdns.org ...
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 1 authorizations URLs from the CA
+ Handling authorization for gofoss.duckdns.org
+ 1 pending challenge(s)
+ Deploying challenge tokens...
OK
+ Responding to challenge for gofoss.duckdns.org authorization...
+ Challenge is valid!
+ Cleaning challenge tokens...
OK
+ Requesting certificate...
+ Checking certificate...
+ Done!
+ Creating fullchain.pem...
+ Done!

sudo touch /var/log/dehydrated

sudo vi /etc/cron.weekly/dehydrated

#!/bin/sh

MYLOG=/var/log/dehydrated
echo "Checking cert renewals at `date`" >> $MYLOG
/etc/dehydrated/dehydrated -c >> $MYLOG 2>&1

sudo chmod +x /etc/cron.weekly/dehydrated

sudo bash /etc/cron.weekly/dehydrated
sudo cat /var/log/dehydrated

Checking cert renewals at Sun 01 Jan 2021 01:29:06 PM CEST
# INFO: Using main config file /etc/dehydrated/config
Processing *.gofoss.duckdns.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Mar 12 10:23:18 2021 GMT (Longer than 30 days). Skipping renew!

sudo curl -sSL https://install.pi-hole.net | bash

sudo pihole-FTL --config webserver.port '8080o,8443os,[::]:8080o,[::]:8443os'
sudo systemctl restart pihole-FTL

sudo ufw allow 8080,8443/tcp
sudo ufw allow out 8080,8443/tcp

sudo cat /etc/dehydrated/certs/gofoss.duckdns.org/privkey.pem /etc/dehydrated/certs/gofoss.duckdns.org/fullchain.pem > combined.pem
sudo mv combined.pem /etc/pihole
sudo pihole-FTL --config webserver.tls.cert '/etc/pihole/combined.pem'

sudo usermod -aG pihole www-data
sudo chown -R pihole:pihole /etc/pihole
sudo chown pihole:pihole -R /var/www/html/admin/

sudo systemctl restart pihole-FTL
sudo systemctl status pihole-FTL

sudo pihole setpassword

wget https://git.io/vpn -O openvpn-install.sh
sudo bash openvpn-install.sh

Welcome to this OpenVPN road warrior installer!

I need to ask you a few questions before starting setup.
You can use the default options and just press enter if you are ok with them.

This server is behind NAT. What is the public IPv4 address or hostname?
Public IPv4 address / hostname [88.888.88.88]: 88.888.88.88

What IPv6 address should the OpenVPN server use?
    1) 1a00:a0a:10a:10a0:a00:00ff:faf0:a011
    2) 1a00:a0a:10a:10a0:a00:00bb:faf0:a022
IPv6 address [1]: 1

Which protocol do you want for OpenVPN connections?
1) UDP (recommended)
2) TCP
Protocol [1]: 1

What port do you want OpenVPN listening to?
Port [1194]: 1194

Which DNS do you want to use with the VPN?
1) Current system resolvers
2) 1.1.1.1
3) Google
4) OpenDNS
5) NTT
6) AdGuard
DNS [1]: 1

Finally, tell me a name for the client certificate.
Client name [client]: computer_vpn

We are ready to set up your OpenVPN server now.

[etc.]

Finished!

The client configuration is available in: /home/gofossadmin/computer_vpn.ovpn
New clients can be added by running this script again.

sudo bash openvpn-install.sh

Looks like OpenVPN is already installed.

What do you want to do?
1) Add a new user
2) Revoke an existing user
3) Remove OpenVPN
4) Exit
Select an option: 1

Tell me a name for the client certificate.
Client name: phone_vpn

[...]

Write out database with 1 new entries
Data Base Updated

Client phone_vpn added, configuration is available at: /home/gofossadmin/phone_vpn.ovpn

cd
sudo chmod 755 *.ovpn
sudo chown gofossadmin:gofossadmin *.ovpn

sudo ufw allow 1194/udp

sudo ufw status numbered

ip ad | grep tun0

ip route | grep tun0

sudo apt install traceroute
traceroute 10.8.0.1

sudo vi /etc/openvpn/server/server.conf

#push "dhcp-option DNS XX.XX.XXX.XXX"
#push "dhcp-option DNS XX.XX.XXX.XXX"
push "dhcp-option DNS 10.8.0.1"

sudo systemctl restart openvpn-server@server

pihole-FTL --config dns.listeningMode 'ALL'